What is the CVSS score of CVE-2025-36384?

CVE-2025-36384 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-36384?

A high-severity vulnerability in IBM Db2 (CVE-2025-36384, CVSS 8.4) enables local users with filesystem access to escalate privileges to higher permission levels, potentially compromising database…. A patch is available.

How to fix or mitigate CVE-2025-36384?

Within 24 hours: Inventory all systems running Db2 and assess which are accessible to untrusted local users; restrict filesystem access to Db2 directories to authorized administrators only. Within 7 days: Apply the available vendor patch to all affected Db2 instances in non-production environments and validate functionality. Within 30 days: Complete patching of all production Db2 systems following change management protocols, with priority given to systems storing sensitive or regulated data.

Windows CVE-2025-36384

HIGH

Unquoted Search Path or Element (CWE-428)

2026-01-30 psirt@us.ibm.com

Windows IBM Db2

8.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

Patch released

Feb 05, 2026 - 19:57 nvd

Patch available

CVE Published

Jan 30, 2026 - 22:15 nvd

HIGH 8.4

DescriptionNVD

IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.

AnalysisAI

Db2 contains a vulnerability that allows attackers to a local user with filesystem access to escalate their privileges due to the use (CVSS 8.4).

Technical ContextAI

affects Db2. IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.